[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] Cross-Site Scripting/Cross-Site Request Forgery in Peter's Login Redirect WordPress Plugin
From:       Summer of Pwnage <lists () securify ! nl>
Date:       2016-08-15 16:20:33
Message-ID: aaa707d5-d44e-1211-3077-a3e4ee59d3e8 () securify ! nl
[Download RAW message or body]

------------------------------------------------------------------------
Cross-Site Scripting/Cross-Site Request Forgery in Peter's Login
Redirect WordPress Plugin
------------------------------------------------------------------------
Yorick Koster, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A Cross-Site Scripting vulnerability was found in the Peter's Login
Redirect WordPress Plugin. This issue allows an attacker to perform a
wide variety of actions, such as stealing Administrators' session
tokens, or performing arbitrary actions on their behalf. In addition the
Plugin is vulnerable to Cross-Site Request Forgery, which allows an
attacker to change any setting of this plugin. In order to exploit this
issue, the attacker has to lure/force a logged on WordPress
Administrator into opening a malicious website.

------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160724-0028

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on Peter's Login Redirect WordPress
Plugin version 2.9.0.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
This issue is resolved in Peter's Login Redirect version 2.9.1.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2016/cross_site_scripting_cross_site_request_forgery_in_peter_s_login_redirect_wordpress_plugin.html


------------------------------------------------------------------------
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/


[prev in list] [next in list] [prev in thread] [next in thread]